Skip to content

Bump postcss-selector-parser, postcss-modules-local-by-default, postcss-modules-scope, css-minimizer-webpack-plugin and postcss-preset-env - #4359

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/multi-b88d7bd07a
Open

Bump postcss-selector-parser, postcss-modules-local-by-default, postcss-modules-scope, css-minimizer-webpack-plugin and postcss-preset-env#4359
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/npm_and_yarn/multi-b88d7bd07a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps postcss-selector-parser to 7.1.7 and updates ancestor dependencies postcss-selector-parser, postcss-modules-local-by-default, postcss-modules-scope, css-minimizer-webpack-plugin and postcss-preset-env. These dependencies need to be updated together.

Updates postcss-selector-parser from 5.0.0 to 7.1.7

Release notes

Sourced from postcss-selector-parser's releases.

7.1.7

  • fix: lossless: true preserves trailing whitespace in a selector that ends empty, such as :not(a, ). Note that :not( ) now yields a selector holding one empty string node rather than an empty selector (#337 by @​theRizwan)
  • fix: consume the whitespace that terminates a hexadecimal escape, so [x="\000061 b"] unescapes to ab (#340 by @​jakezwang)
  • fix: set the parent on every node passed to insertBefore and insertAfter, not only the first (#343 by @​feritcemkahraman)
  • fix: assigning combinator.value clears the stale raw spelling instead of being ignored (#342 by @​SAY-5)
  • fix: keep whitespace around the namespace separator in attribute selectors, so [ foo | bar ] round-trips (#339 by @​dkryaklin)

7.1.6

  • fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5

  • fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
  • fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
  • fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4

  • fix: tolerate non-node children when serializing selectors

7.1.3

  • Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2

v7.1.1

7.1.1

  • perf: replace startsWith with strict equality (#308)
  • fix(types): add walkUniversal declaration (#311)

v7.1.0

7.1.0

  • feat: insert(Before|After) support multiple new node

v7.0.0

7.0.0

  • Feat: make insertions during iteration safe (major)

6.1.5

The 6.x line is now in security-only maintenance

This release exists because the advisory above covers every published 6.x version, and until now the only remediation on offer was an upgrade to 7.x. 6.1.5 is the patched version for the 6.x line.

The line is kept alive for the installed base that cannot move to 7 yet, Tailwind

... (truncated)

Changelog

Sourced from postcss-selector-parser's changelog.

7.1.7 - 2026-10-19

  • fix: lossless: true preserves trailing whitespace in a selector that ends empty, such as :not(a, ). Note that :not( ) now yields a selector holding one empty string node rather than an empty selector (#337 by @​theRizwan)
  • fix: consume the whitespace that terminates a hexadecimal escape, so [x="\000061 b"] unescapes to ab (#340 by @​jakezwang)
  • fix: set the parent on every node passed to insertBefore and insertAfter, not only the first (#343 by @​feritcemkahraman)
  • fix: assigning combinator.value clears the stale raw spelling instead of being ignored (#342 by @​SAY-5)
  • fix: keep whitespace around the namespace separator in attribute selectors, so [ foo | bar ] round-trips (#339 by @​dkryaklin)

7.1.6 - 2026-09-03

7.1.5 - 2026-08-07

  • fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
  • fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
  • fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

7.1.4 - 2026-06-11

  • fix: tolerate non-node children when serializing selectors

7.1.3 - 2026-06-11

  • Improve fix CVE-2026-9358 (NVD) / SNYK-JS-POSTCSSSELECTORPARSER-16873882 (clone/walk)

7.1.2 - 2026-06-09

7.1.1

  • perf: replace startsWith with strict equality (#308)
  • fix(types): add walkUniversal declaration (#311)

7.1.0

  • feat: insert(Before|After) support multiple new node

7.0.0

  • Feat: make insertions during iteration safe (major)

6.1.2

  • Fixed: erroneous trailing combinators in pseudos

6.1.1

... (truncated)

Commits
  • 154c2b0 7.1.7
  • e8dc65f docs: add CVE-2026-104844 to the 7.1.6 changelog entry
  • d5122b0 fix: keep whitespace around the namespace separator in attribute selectors (#...
  • 80ab254 fix: invalidate stale raw spelling on combinator value assignment (#342)
  • ba353c7 fix: set parents for all variadic inserted nodes (#343)
  • 8b2d16d Consume whitespace after hexadecimal CSS escapes (#340)
  • 8f10b8d fix: lossless mode drops whitespace when a selector ends empty (#337)
  • 15c2b45 chore(deps-dev): bump source-map-js from 1.2.1 to 1.2.2 (#347)
  • 4eb3468 7.1.6
  • 62b1917 fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by moox, a new releaser for postcss-selector-parser since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates postcss-modules-local-by-default from 4.0.5 to 4.2.0

Release notes

Sourced from postcss-modules-local-by-default's releases.

v4.2.0

4.2.0 - 2024-12-11

  • feat: add support a /* cssmodules-pure-no-check */ comment

v4.1.0

4.1.0 - 2024-11-11

  • feat: add global() and local() for animations
  • feat: add pure ignore comment
  • fix: css nesting and pure mode
Changelog

Sourced from postcss-modules-local-by-default's changelog.

4.2.0 - 2024-12-11

  • feat: add support a /* cssmodules-pure-no-check */ comment

4.1.0 - 2024-11-11

  • feat: add global() and local() for animations
  • feat: add pure ignore comment
  • fix: css nesting and pure mode
Commits
  • db195e7 chore(release): 4.2.0
  • ba7e8ef feat: added support a cssmodules-pure-no-check comment
  • 39a2f78 docs: fix (#83)
  • e489ff8 chore(release): 4.1.0
  • 3811927 fix: css nesting and pure mode
  • 582bd9e chore: postcss-selector-parser (#81)
  • 9d07eeb feat: add pure ignore comment for CSS Modules (#80)
  • fde62d7 feat: add global and local for animations (#76)
  • a73b700 test: for current pure logic (#74)
  • f1c05a5 test: enhanced test cases to prepare for CSS declaration-level processing (#77)
  • See full diff in compare view

Updates postcss-modules-scope from 3.2.0 to 3.2.1

Release notes

Sourced from postcss-modules-scope's releases.

v3.2.1

3.2.1

Chore

  • update postcss-selector-parser
Changelog

Sourced from postcss-modules-scope's changelog.

3.2.1

Chore

  • update postcss-selector-parser
Commits

Updates css-minimizer-webpack-plugin from 3.4.1 to 8.0.0

Release notes

Sourced from css-minimizer-webpack-plugin's releases.

v8.0.0

8.0.0 (2026-03-02)

⚠ BREAKING CHANGES

  • minimum supported Node.js version is 20.9.0 (#303) (8791cc2)

v7.0.4

7.0.4 (2025-12-11)

Bug Fixes

v7.0.3

7.0.3 (2025-12-05)

Bug Fixes

  • respect errors and warnings from minimizer without code (933fb49)

v7.0.2

7.0.2 (2025-03-06)

Bug Fixes

v7.0.1

7.0.1 (2025-03-06)

Bug Fixes

  • better support worker threads (eeaa5e1)
  • use os.availableParallelism() for parallelism when it is available (b07feeb)

v7.0.0

7.0.0 (2024-05-07)

⚠ BREAKING CHANGES

v6.0.0

... (truncated)

Changelog

Sourced from css-minimizer-webpack-plugin's changelog.

8.0.0 (2026-03-02)

⚠ BREAKING CHANGES

  • minimum supported Node.js version is 20.9.0 (#303) (8791cc2)

7.0.4 (2025-12-11)

Bug Fixes

7.0.3 (2025-12-05)

Bug Fixes

  • respect errors and warnings from minimizer without code (933fb49)

7.0.2 (2025-03-06)

Bug Fixes

7.0.1 (2025-03-06)

Bug Fixes

  • better support worker threads (eeaa5e1)
  • use os.availableParallelism() for parallelism when it is available (b07feeb)

7.0.0 (2024-05-07)

⚠ BREAKING CHANGES

6.0.0 (2024-01-17)

⚠ BREAKING CHANGES

  • minimum supported Node.js version is 18.12.0 (#252) (f7f74c0)

... (truncated)

Commits
Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.


Updates postcss-preset-env from 6.7.0 to 11.6.1

Changelog

Sourced from postcss-preset-env's changelog.

11.6.1

October 5, 2026

11.6.0

October 2, 2026

11.5.5

October 1, 2026

Notable changes:

  • postcss-mixins now implements more of the current spec
  • many plugins now have bounds to prevent CPU starvation or OOM

All updates plugins:

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by romainmenke, a new releaser for postcss-preset-env since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 14, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-b88d7bd07a branch from b18ad3c to 15cec0f Compare October 14, 2026 18:10
@dependabot
Bump postcss-selector-parser, postcss-modules-local-by-default, postc…
339656c 
…ss-modules-scope, css-minimizer-webpack-plugin and postcss-preset-env

Bumps [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) to 7.1.7 and updates ancestor dependencies [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser), [postcss-modules-local-by-default](https://github.com/css-modules/postcss-modules-local-by-default), [postcss-modules-scope](https://github.com/css-modules/postcss-modules-scope), [css-minimizer-webpack-plugin](https://github.com/webpack/css-minimizer-webpack-plugin) and [postcss-preset-env](https://github.com/csstools/postcss-plugins/tree/HEAD/plugin-packs/postcss-preset-env). These dependencies need to be updated together.


Updates `postcss-selector-parser` from 5.0.0 to 7.1.7
- [Release notes](https://github.com/postcss/postcss-selector-parser/releases)
- [Changelog](https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss-selector-parser@5.0.0...7.1.7)

Updates `postcss-modules-local-by-default` from 4.0.5 to 4.2.0
- [Release notes](https://github.com/css-modules/postcss-modules-local-by-default/releases)
- [Changelog](https://github.com/css-modules/postcss-modules-local-by-default/blob/master/CHANGELOG.md)
- [Commits](css-modules/postcss-modules-local-by-default@v4.0.5...v4.2.0)

Updates `postcss-modules-scope` from 3.2.0 to 3.2.1
- [Release notes](https://github.com/css-modules/postcss-modules-scope/releases)
- [Changelog](https://github.com/css-modules/postcss-modules-scope/blob/master/CHANGELOG.md)
- [Commits](css-modules/postcss-modules-scope@v3.2.0...v3.2.1)

Updates `css-minimizer-webpack-plugin` from 3.4.1 to 8.0.0
- [Release notes](https://github.com/webpack/css-minimizer-webpack-plugin/releases)
- [Changelog](https://github.com/webpack/css-minimizer-webpack-plugin/blob/main/CHANGELOG.md)
- [Commits](webpack/css-minimizer-webpack-plugin@v3.4.1...v8.0.0)

Updates `postcss-preset-env` from 6.7.0 to 11.6.1
- [Changelog](https://github.com/csstools/postcss-plugins/blob/main/plugin-packs/postcss-preset-env/CHANGELOG.md)
- [Commits](https://github.com/csstools/postcss-plugins/commits/HEAD/plugin-packs/postcss-preset-env)

---
updated-dependencies:
- dependency-name: css-minimizer-webpack-plugin
  dependency-version: 8.0.0
  dependency-type: direct:development
- dependency-name: postcss-modules-local-by-default
  dependency-version: 4.2.0
  dependency-type: indirect
- dependency-name: postcss-modules-scope
  dependency-version: 3.2.1
  dependency-type: indirect
- dependency-name: postcss-preset-env
  dependency-version: 11.6.1
  dependency-type: direct:development
- dependency-name: postcss-selector-parser
  dependency-version: 7.1.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-b88d7bd07a branch from 15cec0f to 339656c Compare October 21, 2026 16:29

This branch is waiting to be deployed

1 waiting deployment
e2e-tests — 339656c5 Waiting Oct 21, 2026 by dependabot[bot] via test-e2e #387
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants